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Highlights  of  GAO-07-70,  a  report  to  the 
Chairman,  Committee  on  the  Judiciary, 
House  of  Representatives 


EXPORT  CONTROLS 

Agencies  Should  Assess  Vulnerabilities 
and  Improve  Guidance  for  Protecting 
Export-Controlled  Information  at 
Universities 


Why  GAO  Did  This  Study 

Foreign  students  and  scholars  have 
made  substantial  contributions  to 
U.S.  research  efforts  and 
technology  development.  However, 
according  to  a  federal  government 
intelligence  assessment,  foreign 
access  to  sensitive  U.S.  technology 
has  imposed  a  significant  but 
unquantifiable  cost  to  the  United 
States. 

Given  this  risk,  GAO  was  asked  to 
(1)  describe  the  nature  of  the 
research  at  universities  and  identify 
steps  they  take  to  comply  with 
export  controls  and  (2)  assess 
efforts  by  the  Departments  of 
Commerce  and  State — the  key 
export  control  agencies — to 
determine  the  risk  of  export 
violations  in  university  research. 
GAO  reviewed  Commerce  and 
State  export  control  programs  and 
met  with  officials  from  13 
universities,  selected  based  on 
their  foreign  student  populations, 
applications  for  export  licenses, 
and  federal  grants  and  contracts. 


What  GAO  Recommends 


GAO  recommends  that  Commerce 
and  State  use  available  information 
to  assess  potential  vulnerabilities 
and  based  on  this  assessment 
improve  outreach,  guidance,  and 
interagency  coordination.  The 
agencies  generally  concurred,  but 
State  disagreed  with  our 
recommendation  on  assessing 
vulnerabilities.  Broader 
assessments  would  increase  State’s 
knowledge  of  risks  and  help 
improve  its  guidance  to 
universities. 

www.gao.gov/cgi-bin/getrpt7GAO-07-70. 

To  view  the  full  product,  including  the  scope 
and  methodology,  click  on  the  link  above. 

For  more  information,  contact  John  Hutton  at 
(202)  512-7773  or  huttonj@gao.gov. 


What  GAO  Found 

The  U.S.  export  control  system  requires  export  licensing  for  defense  items 
and  items  that  have  both  commercial  and  military  applications,  except 
where  exclusions  apply,  such  as  those  applicable  to  universities  in  some 
circumstances.  The  U.S.  export  control  agencies  place  the  onus  on 
universities  to  understand  and  comply  with  the  regulations.  According  to 
university  officials  we  interviewed,  their  institutions  focus  almost 
exclusively  on  fundamental  research — defined  as  basic  and  applied  research 
in  science  and  engineering,  the  results  of  which  ordinarily  are  published  and 
shared  broadly  within  the  scientific  community.  Such  research  is  generally 
not  subject  to  export  controls.  Universities  we  visited  conduct  research  in 
such  areas  as  nanotechnologies,  computer  security,  and  chemical 
engineering.  To  ensure  their  research  remains  in  the  public  domain, 
university  officials  said  they  negotiate  contract  language  to  remove 
publication  or  other  dissemination  restrictions  for  research  they  consider  to 
be  fundamental.  If  export  controls  apply,  university  officials  stated  they 
sometimes  involve  only  those  students  eligible  to  conduct  the  research 
under  a  license  exclusion,  to  avoid  the  lengthy  license  application  process. 

In  other  cases,  they  refer  such  work  to  off-campus  associated  facilities  that 
can  better  regulate  and  control  foreign  national  access  to  the  research. 
Universities  we  visited  indicated  that  government-provided  training  and 
guidance  on  export  control  regulations  is  limited  in  informing  their  efforts  to 
manage  and  protect  export-controlled  information  in  the  university 
environment. 

State  and  Commerce  officials  expressed  concerns  that  universities  may  not 
correctly  interpret  and  apply  export  regulations,  given  the  large  number  of 
foreign  students  participating  in  research  at  universities  and  the  relative  lack 
of  license  applications  from  universities.  Although  federal  internal  control 
standards  contain  guidelines  for  agencies  to  conduct  risk  assessments,  State 
and  Commerce  have  not  conducted  an  overall  assessment  of  available  trend 
data  on  technology  development  research  and  foreign  participation  in  such 
research  at  U.S.  universities  to  identify  potential  vulnerabilities.  For 
example,  U.S.  govermnent  agencies  collect  data  on  foreign  student 
nationality,  school  enrollment,  and  types  of  research  conducted  at 
universities  for  federal  agencies,  which  could  supplement  information  that 
State  and  Commerce  receive  from  visa  application  processes  and  other 
sources.  Although  State  and  Commerce  provide  guidance  through  training 
seminars,  agency  Web  sites,  and  telephone  help  desks  to  assist  exporters  in 
understanding  and  complying  with  regulations,  officials  stated  that  their 
focus  is  on  processing  export  license  applications — primarily  from  industry. 
Recently,  Commerce  established  an  advisory  committee  composed  of 
industry  and  university  representatives  who  are  expected  to  discuss  issues 
such  as  the  nature  of  university  research  and  its  relation  to  export  controls. 
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Abbreviations 


BIS  Bureau  of  Industry  and  Security 

DDTC  Directorate  of  Defense  Trade  Controls 

DOD  Department  of  Defense 

EAR  Export  Administration  Regulations 

ITAR  International  Traffic  in  Arms  Regulations 

NASA  National  Aeronautics  and  Space  Administration 

SEVIS  Student  and  Exchange  Visitor  Information  System 
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United  States  Government  Accountability  Office 
Washington,  DC  20548 


December  5,  2006 

The  Honorable  F.  James  Sensenbrenner,  Jr. 

Chairman 

Committee  on  the  Judiciary 
House  of  Representatives 

Dear  Mr.  Chairman: 

U.S.  national  security  and  economic  interests  are  heavily  dependent  on 
technological  innovation  and  advantage.  Many  of  the  nation’s  leading-edge 
technologies,  including  defense-related  technologies,  are  being  discovered 
by  American  and  foreign  national  students  and  scholars  in  U.S.  university 
research  and  university-affiliated  laboratories.  As  the  Department  of 
Defense  (DOD)  invests  less  and  less  of  its  funding  on  in-house  research 
and  development,  university-based  discoveries  are  becoming  increasingly 
vital  to  national  security  and  other  U.S.  interests. 

To  mitigate  the  risk  of  technology  and  knowledge  falling  into  the  wrong 
hands,  the  U.S.  government — primarily  the  Departments  of  State  and 
Commerce — controls  the  transfer  of  defense  and  “dual  use”  information.1 
However,  controlling  the  transfer  of  such  information  presents  special 
challenges.  U.S.  export  control  regulations  allow  foreign  students  and 
researchers  without  export  licenses  to  partake  in  fundamental  research, 
defined  to  mean  basic  and  applied  research  in  science  and  engineering,  the 
results  of  which  are  ordinarily  published  and  shared  broadly  within  the 
scientific  community.2  U.S.  policymakers  recognize  that  foreign  students 
and  researchers  have  made  substantial  contributions  to  U.S.  research 
efforts,  but  the  potential  transfer  of  knowledge  of  controlled  defense- 


1  Dual-use  information  is  that  which  has  both  commercial  and  military  application.  15 
C.F.R.  Sec.  730.3. 

2  National  Security  Decision  Directive  189,  issued  September  21,  1985,  and  still  in  effect, 
established  national  policy  for  controlling  the  flow  of  science,  technology,  and  engineering 
information  produced  in  federally-funded  fundamental  research  at  colleges,  universities, 
and  laboratories.  The  directive  defines  fundamental  research  to  mean  basic  and  applied 
research  in  science  and  engineering,  the  results  of  which  ordinarily  are  published  and 
shared  broadly  within  the  scientific  community,  as  distinguished  from  proprietary  research 
and  from  industrial  development,  design,  production,  and  product  utilization,  the  results  of 
which  ordinarily  are  restricted  for  proprietary  or  national  security  reasons. 
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related  technologies  to  their  home  countries  could  have  significant 
consequences  for  U.S.  national  interests.  In  a  September  2005  testimony 
before  Congress,  the  National  Counterintelligence  Executive  stated  that 
while  the  vast  majority  of  foreign  students  in  the  United  States  are 
legitimately  studying  and  advancing  academic  pursuits,  some  seek  to 
acquire  sensitive  U.S.  technologies  to  advance  their  own  countries’ 
economic  and  military  interests.  Additionally,  while  not  limited  to  foreign 
students,  a  2005  federal  report  noted  that  the  technology  lost  as  a  result  of 
foreign  efforts  to  target  sensitive  U.S.  technologies  has  imposed  a 
significant,  but  difficult  to  quantify,  cost  on  the  United  States.3 

On  the  basis  of  your  interest  in  continuing  to  attract  foreign  students  and 
researchers  to  U.S.  universities  while  protecting  export-controlled 
information,  you  asked  us  to  look  at  how  academic  institutions  and  the 
U.S.  government  protect  against  the  illegal  disclosure  of  such  information. 
In  response,  we  (1)  described  the  nature  of  the  research  conducted  at 
universities  and  identified  the  steps  they  have  taken  to  comply  with 
government  export  control  regulations  and  (2)  assessed  the  efforts  of  the 
Departments  of  Commerce  and  State  to  determine  the  risk  of  export 
violations  in  university  research. 

To  conduct  our  work,  we  met  with  officials  from  the  Departments  of 
Commerce  and  State  and  analyzed  their  regulations,  guidance,  and 
training.  We  also  met  with  officials  in  the  Department  of  Defense — which 
participates  in  the  export  control  regulatory  process — and  the  Department 
of  Homeland  Security — which  has  responsibility  for  tracking  foreign 
students  and  scholars  during  their  course  of  study  in  the  United  States.  We 
visited  13  universities  that  were  systematically  selected  based  on  their 
international  student  populations,  export  license  applications,  and  federal 
grants  and  contracts.  At  the  universities,  we  spoke  with  officials  in  such 
positions  as  vice  chancellor  for  research,  director  of  compliance,  and 
general  counsel,  among  others.  While  our  selection  criteria  included  a 
range  of  university  experiences  with  export  controls  and  foreign  students 
and  scholars,  the  universities’  views  stated  in  this  report  do  not  represent 
the  entirety  of  the  U.S.  academic  community.  We  also  spoke  with  officials 
from  various  research  institutes  and  academic  associations.  Additional 


3  Office  of  the  National  Counterintelligence  Executive,  Annual  Report  to  Congress  on 
Foreign  Economic  Collection  and  Industrial  Espionage — 2004 ,  NCIX  2005-10006, 
(Washington,  D.C.:  April  2005). 
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details  on  the  scope  and  methodology  of  our  review  can  be  found  in 
appendix  I.  We  conducted  our  review  from  March  through  November  2006 
in  accordance  with  generally  accepted  government  auditing  standards. 


Results  in  Brief 


According  to  university  officials  we  interviewed,  their  institutions  focus 
almost  exclusively  on  fundamental  research,  which  is  generally  not 
subject  to  export  controls.  By  conducting  fundamental  research  in  areas 
such  as  artificial  intelligence,  nanotechnology,  and  robotics,  universities 
can  openly  share  and  publish  their  research  findings  within  a  broad 
community  that  includes  international  students  and  scholars.  To  ensure 
their  research  remains  in  the  public  domain,  most  university  officials  said 
they  extensively  screen  and  review  potential  contracts  and  grants  for 
fundamental  research  to  ensure  there  are  no  publication  or  other 
dissemination  restrictions.  If  export  controls  apply,  university  officials 
stated  they  sometimes  reject  the  research  contract,  involve  only  students 
and  scholars  who  can  conduct  the  research  under  license  exclusions,  or 
refer  such  work  to  associated  facilities  and  laboratories  located  off- 
campus  that  can  better  regulate  and  control  foreign  national  access  to 
such  research.  The  U.S.  export  control  system  relies  on  universities  to 
understand  and  correctly  determine  when  export  regulations  apply  and  to 
follow  the  regulations  accordingly.  To  educate  themselves  on  export 
control  issues,  academic  officials  take  training  courses  offered  through 
Commerce,  State,  and  university  associations;  search  government  and 
other  Web  sites;  request  guidance  from  knowledgeable  officials  at  other 
universities;  and  hire  outside  legal  counsel  and  expertise  on  export 
controls.  However,  the  universities  we  visited  indicated  that  government- 
provided  training  and  guidance  on  export  regulations  is  limited  in 
informing  their  efforts  to  manage  and  protect  export-controlled 
information,  and  it  does  not  clarify  when  fundamental  research  exclusions 
should  apply. 

Although  State  and  Commerce  provide  some  guidance  and  training  to 
assist  exporters  in  understanding  and  complying  with  export  regulations, 
these  agencies  have  not  fully  assessed  the  potential  for  transfers  of  export- 
controlled  information  to  foreign  nationals  in  the  course  of  U.S.  university 
research.  State  and  Commerce  target  their  resources  to  processing  license 
applications  and  provide  assistance  to  exporters  through  guidance, 
training,  and  other  outreach.  However,  they  rarely  coordinate  these  efforts 
or  strategize  their  outreach  on  export  controls  to  the  academic 
community.  Furthermore,  officials  expressed  concerns  that  universities 
may  not  correctly  interpret  and  apply  export  regulations — a  concern 
raised  by  the  rarity  of  export  license  applications  from  U.S.  academic 
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institutions,  considering  the  large  foreign  student  and  scholar  populations 
studying  and  conducting  research  in  the  United  States.  However,  the 
agencies  have  not  conducted  an  overall  assessment  of  available  data  on 
foreign  participation  in  research  at  U.S.  universities  to  determine  whether 
such  research  would  require  export  protections.  For  example,  U.S. 
government  agencies  collect  data  on  foreign  student  nationality,  school 
enrollment,  and  federally-funded  research  conducted  at  universities, 
which  could  supplement  information  that  State  and  Commerce  receive 
from  visa  application  processes  and  other  leads.  Furthermore,  State  and 
Commerce  outreach  efforts  have  been  largely  reactive,  and  they  have  only 
recently  begun  to  engage  with  the  affected  research  community  in  forums 
to  promote  dialogue  on  issues  such  as  fundamental  research  and  its 
relation  to  export  controls. 

To  improve  their  oversight  of  export-controlled  information  at 
universities,  we  are  recommending  that  the  Secretaries  of  Commerce  and 
State  direct  their  export  control  entities  to  strategically  assess  potential 
vulnerabilities  in  the  conduct  and  publication  of  academic  research 
through  analyzing  available  information  on  technology  development  and 
foreign  student  populations  at  universities.  This  could  help  to  determine 
the  extent  to  which  research  at  universities  may  be  subject  to  export 
controls.  Furthermore,  we  recommend  that,  on  the  basis  of  this 
assessment,  Commerce  and  State  further  coordinate  efforts  and  improve 
guidance  and  outreach  to  ensure  that  universities  understand  when  to 
apply  export  controls. 

The  Department  of  Commerce  generally  agreed  with  our  report  and 
indicated  that  it  has  undertaken  efforts  to  increase  its  outreach  to  the 
academic  community  and  plans  to  further  assess  vulnerabilities  and  more 
precisely  target  outreach  and  compliance  efforts.  The  Department  of  State 
agreed  with  our  recommendation  to  improve  interagency  coordination  on 
training  and  guidance  for  universities  and  disagreed  with  our  report’s 
finding  that  it  does  not  assess  the  potential  vulnerabilities  associated  with 
export-controlled  information  at  academic  institutions.  However,  we 
maintain  that  a  trend  analysis  of  available  data  on  foreign  students  and 
scholars  and  federal  contracts  for  research  at  academic  institutions  would 
be  a  valuable  investment  in  providing  a  proactive  plan  for  targeting 
outreach  and  training  for  the  academic  community.  While  State  disagreed 
with  our  recommendation,  in  its  response  it  noted  that  it  is  considering 
conducting  such  an  assessment.  In  addition,  the  Departments  of  State  and 
Homeland  Security  provided  technical  comments  that  were  incorporated 
as  appropriate  throughout  the  report.  The  Department  of  Defense  had  no 
comments  on  this  report. 
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Background 


In  November  2003,  GAO  reported  that  university  research  is  a  vital  part  of 
the  nation’s  research  and  development  efforts,  primarily  funded  by  the 
federal  government  because  of  the  broad  consensus  that  university 
research  is  a  long-term  national  investment  in  the  future.4  The  federal 
investment  in  university  research  has  yielded  thousands  of  inventions  each 
year  that  have  fostered  the  development  of  new  technologies,  stimulated 
the  creation  of  new  jobs,  and  improved  the  quality  of  life.  These  benefits 
come  through  open  communication  among  scientists  and  the  sharing  of 
research  results.  A  National  Academy  of  Sciences  official  underscored  the 
importance  of  this  issue  in  September  2005  congressional  testimony, 
stating  that  over  55  percent  of  the  engineering  Ph.D.  students  in  the  United 
States  are  foreign-born  and  that  their  research  helps  strengthen  the  United 
States  in  the  fastest-moving  new  technologies,  some  of  which  have 
potential  defense-related  application.5 

Foreign  students  and  scholars  bring  needed  skills  to  our  increasingly 
knowledge-based  economy,  build  bridges  to  other  countries  and 
professional  communities,  and  make  other  valuable  contributions  to  our 
society.  These  contributions  are  particularly  important  for  maintaining  our 
competitiveness,  fostering  productivity  and  innovation,  and  strengthening 
our  workforce.  While  the  United  States  has  long  been  a  global  leader  in 
higher  education  and  one  of  the  most  desired  destinations  for  foreign 
students,  international  competition  for  the  best  and  the  brightest  students 
and  scholars  is  growing.  Countries  such  as  China  have  improved  their 
educational  capacities,  possibly  decreasing  the  incentives  for  students  and 
scholars  to  study  in  the  United  States.  The  recent  slowing  of  foreign 
student  enrollment  in  United  States  universities  and  colleges  has  raised 
concerns  about  the  extent  to  which  we  will  be  able  to  continue  attracting 
talented  foreign  students  and  researchers  to  our  universities  and  to  our 
workforce  after  they  graduate  while  also  maintaining  our  nation’s  security. 

Recognizing  the  importance  of  balancing  national  security  interests  with 
the  need  to  allow  the  free  exchange  of  information  at  U.S.  academic 
institutions  of  higher  learning,  the  federal  government  is  a  major  funding 


4  GAO,  University  Research:  Most  Federal  Agencies  Need  to  Better  Protect  against 
Financial  Conflicts  of  Interest,  GAO-04-31  (Washington,  D.C.,  Nov.  14,  2003). 

5House  of  Representatives  Committee  on  the  Judiciary,  Subcommittee  on  Immigration, 
Border  Security,  and  Claims,  Hearing  on  Sources  and  Methods  of  Foreign  Nationals 
Engaged  in  Economic  and  Military  Espionage,  Serial  No.  109-58,  (Washington,  D.C.,  Sept. 
15,  2005). 
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source  for  research  conducted  at  U.S.  universities  and  colleges.  In  fiscal 
year  2003,  the  federal  government  funded  almost  two-thirds — 
approximately  $29.6  billion — of  all  basic  and  applied  research  funding 
provided  to  universities  and  colleges  by  external  sources  (see  fig.  1).  Other 
sources  of  funding  come  from  industry,  nonprofit  organizations,  as  well  as 
state  and  local  governments. 


Figure  1:  Basic  and  Applied  U.S. -Based  Research  Funding  Sources  for  Universities 
and  Colleges  in  Fiscal  Year  2003 


Federal  government 
Industry 
Nonprofit 
Other3 


Source:  National  Science  Foundation  data,  GAO  analysis. 

“’Other”  includes  universities,  colleges,  and  state  and  local  governments. 


According  to  National  Science  Foundation  data  for  fiscal  year  2003,  the 
National  Institutes  of  Health  of  the  Department  of  Health  and  Human 
Services  funded  approximately  62  percent  (about  $14.1  billion)  of  all 
federally  funded  science  and  technology  research  conducted  by 
universities  and  colleges.  Other  federal  research  funding  sources  identified 
by  university  officials  we  spoke  with  include  the  National  Aeronautics  and 
Space  Administration  (NASA);  the  National  Science  Foundation;  various 
Department  of  Defense  agencies,  including  the  Navy  and  the  Defense 
Advanced  Research  Projects  Agency;  and  the  Departments  of  Energy, 

State,  and  Transportation.  This  level  of  government  funding  was 
consistent  with  that  of  several  of  the  universities  we  visited,  where 
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officials  stated  that  their  research  is  primarily  funded  by  government 
grants  and  contracts,  including  contracts  that  are  directed  toward  industry 
and  subsequently  subcontracted,  or  “flowed  through,”  to  universities. 

Over  the  past  several  decades  in  which  the  current  export  control  system 
has  been  in  effect,  the  global  economy  has  changed  significantly.  DOD 
continues  to  seek  innovative  technologies  to  meet  the  needs  of  warfighters 
and  to  counter  technologies  developed  by  potential  U.S.  adversaries.  To 
achieve  these  ends,  DOD  has  become  more  willing  to  rely  on  the 
nondefense  industry  to  supply  its  needs.  DOD  increasingly  relies  on 
commercial  research,  for  areas  such  as  information  systems  and 
telecommunications,  where  the  cutting  edge  of  technological 
advancement  lies.  Such  advances  in  communications  technology  have 
been  made  possible  to  a  large  extent  by  basic  research,  much  of  which 
was  initially  developed  in  universities  and  often  involved  foreign  students 
and  scholars. 

The  U.S.  export  control  system  relies  on  the  ability  of  exporters  to 
recognize  when  certain  goods  and  services  meet  the  criteria  for  requiring 
an  export  license.  The  system  is  primarily  divided  between  two  regulatory 
regimes,  one  managed  by  the  Department  of  State  and  another  managed 
by  the  Department  of  Commerce.  The  regimes  require  export  licensing  for 
defense-related  items  and  information,  including  data,  except  where 
exclusions  apply.  Both  regulatory  regimes  include  exclusions  applicable  in 
some  circumstances  to  universities  and  other  academic  institutions  of 
higher  learning.  The  U.S.  export  control  system  places  the  onus  on 
universities  and  other  exporters  to  understand  and  comply  with  the  export 
control  regulations. 

The  Department  of  State  Directorate  of  Defense  Trade  Controls  (DDTC) 
manages  defense  items  through  the  International  Traffic  in  Arms 
Regulations  (ITAR).6  State  issues  export  licenses  based  on  the  U.S. 
Munitions  List,  which  identifies  defense  articles,  services,  and  related 
technical  data  that  are  controlled  for  export.  Moreover,  the  regulations 


6  The  ITAR  (22  C.F.R.§§  120-130)  implements  the  Arms  Export  Control  Act  (22  U.S.C.  2778). 
The  Act  authorizes  the  President  to  control  the  export  of  defense  articles  and  services  and 
promulgate  corresponding  regulations,  which  has  been  delegated  to  the  Secretary  of  State 
by  Executive  Order  11958,  as  amended.  The  ITAR  defines  fundamental  research  to  mean 
basic  and  applied  research  in  science  and  engineering  where  the  resulting  information  is 
ordinarily  published  and  shared  broadly  within  the  scientific  community,  as  distinguished 
from  research,  the  results  of  which  are  restricted  for  proprietary  reasons  or  specific  U.S. 
government  access  and  dissemination  control.  22  C.F.R.  sec.  120. 11  (a)(8). 
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state  that  unless  otherwise  expressly  exempted  or  excluded,  an  export 
license  is  required  for  the  oral,  visual,  or  documentary  transmission  of 
technical  data  by  U.S.  persons  to  foreign  persons,7  by  such  means  as  in- 
person  or  telephone  discussions  and  written  correspondence  including 
electronic  messages,  even  when  they  are  in  the  United  States.  The  U.S. 
Munitions  List  contains  21  categories,  covering  items  such  as  weapons, 
chemical  and  biological  agents,  missiles,  and  both  commercial  and  military 
satellites. 

The  Department  of  Commerce’s  Bureau  of  Industry  and  Security  (BIS) 
manages  dual-use  items,  having  both  military  and  commercial 
applications,  through  the  Export  Administration  Regulations  (EAR).8 
Under  these  regulations,  exporters  are  to  obtain  prior  government 
authorization  in  the  form  of  a  license  from  BIS,  or  determine  that  a  license 
is  not  needed,  before  exporting  dual-use  items.  Commerce  requires  an 
export  license  for  the  release  of  technology  or  software  source  code  to  a 
foreign  national9  because  such  a  release  is  deemed  to  be  an  export10  to  the 


'  The  ITAR  defines  a  foreign  person  as  any  natural  person  who  is  not  a  lawful  permanent 
resident  as  defined  by  8  U.S.C.  sec.  1101(a)(20)  or  who  is  not  a  protected  individual  as 
defined  by  8  U.S.C.  1324b(a)(3).  It  also  means  any  foreign  corporation,  business 
association,  partnership,  trust,  society,  or  any  other  entity  or  group  that  is  not  incorporated 
or  organized  to  do  business  in  the  United  States,  as  well  as  international  organizations, 
foreign  governments,  and  any  agency  or  subdivision  of  foreign  governments  (e.g., 
diplomatic  missions). 

8  The  EAR  (15  C.F.R.  §§  730-774)  implements  the  Export  Administration  Act  (50  U.S.C. 
2401-2420).  Although  the  Act  has  lapsed,  export  regulations  have  been  extended  through 
executive  orders,  of  which  Executive  Order  13222  (August  17,  2001)  is  the  most  recent.  The 
EAR,  like  National  Security  Decision  Directive  189,  defines  fundamental  research  to  mean 
basic  and  applied  research  in  science  and  engineering  where  the  resulting  information  is 
ordinarily  published  and  shared  broadly  within  the  scientific  community.  Such  research 
can  be  distinguished  from  proprietary  research  and  from  industrial  development,  design, 
production,  and  product  utilization,  the  results  of  which  ordinarily  are  restricted  for 
proprietary  reasons  or  specific  national  security  reasons.  15  C.F.R.  sec.734.8. 

9  The  EAR  defines  a  foreign  national  as  a  person  who  is  not  lawfully  admitted  for 
permanent  residence  in  the  United  States  or  a  person  who  is  not  a  protected  individual 
under  the  Immigration  and  Naturalization  Act,  8  U.S.C.  1324b(a)(3).  15  C.F.R.  sec.734.2 
(b)(2)(h). 
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home  country  or  countries  of  the  foreign  national,  even  if  the  person  is  in 
the  United  States.  Commerce  regulates  the  dual-use  items  specified  in  the 
EAR’s  Commerce  Control  List,  which  are  controlled  for  a  variety  of 
reasons,  including  restricting  exports  that  could  significantly  enhance  a 
country’s  military  potential,  preventing  exports  to  countries  that  sponsor 
terrorism,  and  limiting  the  proliferation  of  chemical,  biological,  and 
nuclear  weapons  and  their  delivery  systems.  The  Commerce  Control  List 
has  10  categories  covering  items  such  as  electronics,  computers, 
telecommunications,  and  avionics. 


Universities  Focus  on 
Fundamental 
Research  to  Comply 
with  Export 
Regulations 


Most  of  the  universities  we  visited  aim  to  ensure  that  their  research 
remains  unrestricted  and  in  the  public  domain  by  conducting  fundamental 
research,  which  is  generally  excluded  from  export  controls.  To  ensure  that 
most  of  the  research  conducted  on  their  campuses  does  not  require  an 
export  license,  these  universities  negotiate  to  exclude  any  restrictions  on 
publishing  and  disseminating  the  results  of  the  research  they  consider  to 
be  fundamental.  For  research  that  may  be  subject  to  export  control 
regulations,  the  universities  we  visited  have  taken  steps  to  ensure  that 
their  personnel  are  informed  about  and  comply  with  these  regulations. 


Universities  Focus  on  According  to  most  university  officials,  their  institutions  conduct  basic  and 

Conducting  Fundamental  applied  science  and  engineering  research  in  a  wide  variety  of  areas, 
Research  producing  findings  that  are  conducted,  shared,  and  published  openly 

within  a  broad  community  that  includes  international  students  and 
scholars.  Table  1  lists  examples  of  research  areas  conducted  at 
universities  that  we  visited. 


10  These  transfers  are  commonly  referred  to  as  “deemed”  exports.  Commerce’s  export 
control  regulations  (15  CFR  734.2(b)(2)(ii))  specifically  utilize  the  term  “deemed  export”  to 
describe  these  transfers.  While  the  ITAR  does  not  use  a  precise  corresponding  term,  State 
Department  officials  told  us  the  concept  of  a  “deemed”  export  is  covered  under  the  ITAR’s 
general  definition  of  an  export — that  is,  an  export  means  “disclosing  (including  oral  or 
visual  disclosure)  or  transferring  technical  data  to  a  foreign  person,  whether  in  the  United 
States  or  abroad”  (see  22  C.F.R.  Sec.  120.17),  and  the  ITAR’s  requirements  for  the  export  of 
unclassified  technical  data,  which  state  “a  license  is  required  for  the  oral,  visual  or 
documentary  disclosure  of  technical  data  by  U.S.  persons  to  foreign  persons. .  .regardless  of 
the  manner  in  which  the  technical  data  is  transmitted  (e.g.,  in  person,  by  telephone, 
correspondence,  electronic  means,  etc.)”  (see  22  C.F.R.  Sec.  125.2(a)  and  (c)).  State 
officials  told  us  they  also  refer  to  these  transfers  as  “deemed  exports.” 
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Table  1 :  Examples  of  Research  Areas  Conducted  at  Universities  Visited  by  GAO 

•  Artificial  intelligence 

•  Atmospheric  research 

•  Biological  sciences 

•  Chemical  engineering 

•  Computational  science  and  computer  architecture 

•  Computer  security 

•  Integrated  circuit  design  and  fabrication 

•  Internet  communications  and  advanced  networking 

•  Nanotechnologies 

•  Physics 

•  Remote  sensing  of  Earth 

•  Robotics 

Source:  GAO  analysis  of  universities’  Web  sites. 


Most  officials  we  spoke  with  stated  that  their  universities  specifically  seek 
out  research  contracts  and  grants  that  do  not  restrict  their  ability  to 
conduct  fundamental  research  by  extensively  screening  and  reviewing  the 
terms  of  potential  contracts  and  grants.  If  a  contract  includes  restrictions 
on  fundamental  research,  some  universities  attempt  to  negotiate  the 
restrictive  language  out  of  the  contract.  Some  university  officials  noted 
that  such  negotiations  have  become  more  frequent  because  government 
and  industry  contracting  officials  are  increasingly  inserting  restrictive 
language  in  contracts  for  research  that  universities  consider  to  be 
fundamental.  For  example,  according  to  university  officials,  DOD  agencies 
sometimes  insert  standard  acquisition  regulations  language  that  prohibits 
the  contractor  from  releasing  information,  even  unclassified  information, 
outside  of  the  contractor’s  organization.11  According  to  university  officials, 
a  rule  proposed  by  DOD  would  have  restricted  universities  from  sharing 
information  with  other  academic  institutions  and  publishing  research  or 


nDefense  Federal  Acquisition  Regulation  252.204-7000  prohibits  the  contractor  from 
releasing  any  unclassified  information  to  anyone  outside  of  the  contractor’s  organization 
unless  the  contracting  officer  has  given  prior  written  approval  or  the  information  is 
otherwise  in  the  public  domain  before  the  date  of  release. 
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otherwise  making  such  information  available  in  the  public  domain.12  DOD 
revised  the  rule  to  minimize  the  impact  on  fundamental  research 
conducted  at  universities  and  acknowledged  that  the  free  exchange  of 
ideas  is  a  foundational  concept  of  U.S.  research  and  educational 
institutions.13  Several  universities  we  interviewed  stated  that  if  they  are 
unsuccessful  in  negotiating  the  restrictive  language  out  of  those  research 
contracts  they  consider  to  be  fundamental,  they  sometimes  reject  the 
opportunity  to  participate  in  the  research. 

For  research  subject  to  export  control  restrictions,  universities  may 
modify  the  way  the  research  is  conducted  to  avoid  the  export  license 
application  process — a  process  some  officials  characterized  as  time- 
consuming  and  complicated.  For  example,  officials  at  one  university  said 
that  instead  of  applying  for  an  export  license  for  one  project,  they  opted  to 
use  only  researchers  who  are  excluded  from  export  license  requirements, 
such  as  U.S.  citizens  or  foreign  nationals  with  permanent  residency  status. 
In  other  cases,  university  officials  stated  they  move  export-controlled 
work  to  off-campus  facilities  and  laboratories  administered  by  the 
universities  or  the  entity  sponsoring  the  contract,  where  such  research  can 
be  better  segregated  and  controlled.  At  the  six  university-administered 
laboratories  that  we  visited,  each  used  access  control  systems  such  as 
badges  and  computer  passwords.  Such  restrictions  limiting  access  to 
information  at  laboratories  are  not  as  common  on  the  main  campuses  we 
visited,  where  research  information  is  more  openly  available. 


Efforts  Undertaken  by 
Universities  to  Understand 
and  Comply  with  Export 
Control  Regulations 


According  to  a  State  official,  U.S.  export  control  regulations  are  designed 
for  “self-compliance.”  For  the  academic  community  specifically,  State 
officials  said  that  it  is  the  universities’  responsibility  to  conduct  due 
diligence  to  determine  whether  their  research  activities  are  subject  to 
export  laws,  and  to  identify  whether  an  export  license  is  required  for 
foreign  nationals  within  their  purview.  University  officials  we  spoke  with 


12In  2005,  DOD  issued  a  proposed  regulation  that  would  have  required  contract  officers  to 
ensure  that  contracts  identify  any  export-controlled  information  and  technology  and  the 
contractor  to  not  allow  access  by  foreign  nationals  or  persons  to  export-controlled 
information  and  technology  without  obtaining  an  export  license,  other  authorization,  or 
exemption.  According  to  university  associations,  they  were  concerned  that  application  of 
this  regulation  by  contracting  officers  would  not  take  into  consideration  whether  export- 
controlled  information  is  involved  when  restricting  universities  from  sharing  the  results  of 
fimdamental  research. 

13At  the  time  of  this  report,  the  revised  rule  (2004-D010)  had  not  been  finalized. 
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have  taken  actions  to  become  educated  on  complex  export  control 
regulations — an  undertaking  that  several  officials  indicated  requires  an 
extensive  time  commitment  because  the  government  does  not  provide 
sufficient  guidance.  Some  universities  have  also  dedicated  other  resources 
to  ensure  they  comply  with  U.S.  export  control  laws,  such  as  hiring  legal 
counsel. 

To  understand  export  control  regulations,  universities  we  visited 
frequently  rely  on  agency  training  and  guidance.  Several  university 
officials  stated  that  they  had  attended  training  seminars  sponsored  by 
Commerce,  as  well  as  conferences  sponsored  by  the  Society  for 
International  Affairs,  a  nonprofit  defense  trade  industry  association  that 
sponsors  events  such  as  conferences  and  workshops  to  educate  and 
instruct  the  export  community  on  all  aspects  of  defense  and  commercial 
exports  and  technology  transfers.14  Most  university  officials  indicated  that 
they  also  accessed  Commerce  and  State  Web  sites  or  their  respective 
telephone  help  desks. 

However,  several  university  officials  indicated  that  the  agency  training  and 
guidance  have  limited  utility  for  academic  institutions.  For  example, 
according  to  some  university  officials,  training  provided  by  Commerce  and 
State  does  not  discuss  how  export  regulations  apply  to  universities  that 
have  fundamental  research  exclusions.  One  university  official 
characterized  the  Commerce-sponsored  session  that  he  attended  as  being 
“entry  level”  training  directed  at  the  corporate  community.  Commerce 
officials  have  acknowledged  that  about  95  percent  of  the  attendees  at  their 
seminars  are  repeat  attendees,  primarily  from  industry.  Some  university 
officials  stated  that  the  training  was  too  narrowly  focused  on  topics  that 
do  not  pertain  to  universities.  University  officials  also  raised  concerns 
with  State’s  and  Commerce’s  Web-based  guidance.  Some  university 
officials  characterized  the  Web-based  information  provided  by  Commerce 
and  State  as  being  unclear  or  only  providing  a  general  introduction  to  a 
topic  without  providing  sufficient  details  to  fully  answer  questions 
concerning  export  controls.  For  example,  a  university  official  stated  that 
the  Commerce  and  State  Web  sites  do  not  identify  which  forms 
universities  need  to  submit  in  seeking  export  licenses  to  involve  foreign 
researchers  in  certain  research.  Also,  although  some  university  officials 


14  The  Society  for  International  Affairs  is  a  volunteer,  nonprofit,  educational  organization 
jointly  formed  in  1967  by  the  federal  government  and  industry.  Its  purpose  is  to  serve  as  a 
forum  for  the  exchange  of  information — through  events  such  as  luncheons,  conferences, 
and  workshops — related  to  export  and  import  licensing  issues. 
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indicated  that  Commerce  and  State  officials  provide  very  useful 
information  via  the  telephone  help  desks,  they  stated  that  getting 
immediate  help  was  difficult  at  times  and  that  return  messages  were 
untimely. 

To  further  their  understanding  of  export  control  regulations,  several 
universities  have  sought  out  other  sources  of  information,  specifically 
sources  tailored  to  universities.  Several  university  officials  indicated  that 
they  rely  on  best  practices  by  other  universities  that  have  shared  and 
developed  approaches  for  addressing  different  export  control  issues, 
including  the  Massachusetts  Institute  of  Technology,  Stanford  University, 
and  the  Universities  of  Oklahoma  and  Maryland.  For  example,  officials 
from  one  university  said  that  they  have  relied  on  other  universities  for 
guidance  on  applying  for  export  licenses.  Universities  and  academic 
associations  exchange  best  practice  information  through  seminars  and 
workshops  sponsored  by  nongovernmental  organizations,  such  as  the 
Association  of  American  Universities,  the  Council  on  Governmental 
Relations,  and  the  National  Council  of  University  Research 
Administrators . 

Many  of  the  universities  that  we  visited  have  also  developed  written 
guidance  and  training  to  help  educate  university  personnel  on  their 
responsibility  to  comply  with  the  export  control  regulations.  For  example, 
officials  from  one  university  we  visited  have  developed  a  Web-based 
decision  tree  to  assist  university  personnel  in  determining  the  applicability 
of  export  controls  to  their  research  projects.  Officials  from  another 
university  stated  that  their  research  institution  requires  that  all  staff  take 
training — available  on  the  university’s  intranet  site — related  to  the 
handling  of  controlled  information.  Another  university  adopted  a  targeted 
strategy  of  export  control  education  for  its  researchers,  reaching  out  to  the 
researchers  and  programs  most  likely  to  be  affected  by  export  controls, 
such  as  those  in  engineering. 

A  number  of  universities  we  visited  have  invested  in  other  resources  to 
ensure  they  comply  with  export  control  regulations.  Some  hire  outside 
legal  counsel  who  specialize  in  export  controls.  For  example,  one 
university  routinely  employs  outside  counsel  to  mitigate  the  risk  of 
committing  violations,  because  of  the  severity  of  the  penalties  for 
noncompliance.15  According  to  officials  at  another  university,  thousands  of 


15  The  EAR  and  ITAR  both  impose  criminal  and  civil  penalties. 
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dollars  are  spent  each  year  for  legal  services  addressing  export  controls. 
Finally,  two  universities  we  visited  use  a  software  program  to  help 
determine  if  a  proposed  research  project  grant  or  contract  is  subject  to 
export  license  requirements.  According  to  officials  at  these  two 
universities,  the  software  program  helps  to  facilitate  a  process  that  is  very 
difficult,  time-consuming,  and  costly  because  of  the  length  and  complexity 
of  U.S.  export  control  regulations. 


State  and  Commerce 
Have  Not  Assessed 
the  Potential  Risk  to 
Export-Controlled 
Information  at 
Universities 


State  and  Commerce  officials  indicated  that  their  top  priority  is  processing 
the  thousands  of  license  applications  received  annually — the  vast  majority 
of  which  are  from  industry — leaving  few  resources  for  guidance  and 
outreach  to  exporters.  However,  they  expressed  concerns  that  universities 
may  be  misinterpreting  their  responsibilities  under  export  regulations  and 
that  the  potential  may  exist  for  foreign  nationals  to  access  sensitive 
information  on  U.S.  campuses.  Despite  these  concerns,  neither  agency  has 
analyzed  available  information  on  university  research  and  foreign  student 
populations  to  determine  the  potential  risk  of  the  illegal  transfer  of 
controlled  information. 


Commerce  and  State 
Prioritize  Processing  of 
License  Applications  and 
Target  Their  Resources  to 
Industry 


According  to  Commerce  officials,  BIS  receives  approximately  1,000 
deemed  export  license  applications  per  year.  Officials  confirmed  that  most 
of  these  applications  are  received  from  industry.  For  example,  Commerce 
officials  stated  that  of  the  865  deemed  export  licenses  processed  by 
Commerce  in  fiscal  year  2006,  99.7  percent  were  from  industry.  These 
same  officials  noted  that  over  the  last  few  years,  only  two  universities 
have  submitted  deemed  export  license  applications.  A  2004  Commerce 
Inspector  General  report  stated  that  license  application  data  suggest  that 
many  industries  (including  chemical  and  biotechnology  industries), 
academic  institutions,  and  federal  research  facilities  that  may  employ  or 
host  foreign  nationals  are  not  applying  for  deemed  export  licenses. 


State  and  Commerce  officials  stated  that  beyond  processing  export 
licenses,  few  resources  remain  for  providing  outreach  and  guidance  to  the 
export  community.  While  both  agencies  provide  guidance  and  outreach 
through  conferences  cosponsored  with  other  organizations  and  agency- 
sponsored  training,  much  of  their  outreach  is  directed  at  industry,  and  not 
the  academic  community.  Commerce  cosponsors  approximately  45  formal 
seminars  annually,  along  with  specialty  seminars  on  deemed  exports 
ranging  from  basic  to  advanced.  As  its  principal  training  activity,  State 
provides  speakers  for  export  licensing  conferences  that  are  organized  by 
the  Society  for  International  Affairs  and  tailored  to  the  needs  of  industry 
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and  government  participants.  An  official  acknowledged  that  State  is 
unable  to  fill  all  of  the  speaking  requests  that  it  receives,  which  number  in 
the  hundreds  each  year.  Instead,  State  responds  to  requests  based  on  the 
availability  of  personnel  and  travel  funds.  From  January  2004  through  June 
2006,  State  officials  approved  their  personnel  to  participate  in 
approximately  135  outreach  activities  and  events. 

Officials  at  both  agencies  indicated  that  their  visits  to  or  staffing  of 
training  seminars  for  the  academic  community  are  often  in  response  to 
specific  invitations  from  universities.  A  State  official  who  is  responsible 
for  export  outreach  reported  that  since  2003,  only  one  event  has  been  held 
that  was  specifically  targeted  to  the  academic  community.  While  State 
policy  officials  have  indicated  that  they  would  like  to  conduct  more 
conferences  for  universities  in  the  future,  the  official  responsible  for  these 
conferences  stated  that  none  are  currently  scheduled  because  of  limited 
resources.  For  Commerce,  one  official  has  noted  that  more  universities 
have  recently  begun  attending  its  training  seminars.  However,  while 
Commerce  stated  it  has  increased  its  outreach  to  universities  in  the  last 
few  years,  GAO  analysis  of  its  outreach  records  indicated  that  several 
events  that  Commerce  categorized  as  targeted  at  universities  were 
provided  to  government  research  entities  instead. 

In  addition  to  conferences  and  agency-provided  training,  both  State  and 
Commerce  maintain  telephone  help  desks  and  Web  sites  for  exporters  to 
obtain  guidance  on  export  controls.  State  employs  a  three-person 
response  team  to  answer  telephone  inquiries  and  provide  informal  advice 
on  export  control  issues  in  response  to  the  thousands  of  calls  received 
monthly  from  industry  and  academic  institutions.  Officials  have  indicated 
that  they  have  improved  help  desk  response  times.  Commerce’s  and 
State’s  Web  sites  provide  exporters  with  guidance  on  when  a  license  is 
needed  and  how  a  license  can  be  procured.  However,  information  is  aimed 
at  a  more  general  audience,  although  a  Commerce  official  stated  that  the 
agency  has  posted  more  background  information  on  the  fundamental 
research  exclusion  on  its  Web  site.  State  officials  noted  that  they  have 
made  their  Web  site  more  user-friendly  and  taken  steps  to  expand  the  Web 
site  to  provide  additional  guidance  to  exporters. 

Although  State  and  Commerce  have  separate  export  control  jurisdictions, 
the  2004  interagency  Offices  of  Inspector  General  report  stated  that 
Commerce  and  State  could  improve  their  outreach  by  providing  joint 
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training  that  explains  the  differences  between  the  two  agencies’  licensing 
requirements  and  procedures — a  recommendation  that,  according  to  the 
report,  was  supported  by  company  and  academic  officials.16  Furthermore, 
previous  GAO  reports  have  recommended  that  Commerce  and  State 
should  better  coordinate  their  efforts  on  analysis  and  export  oversight.17 
However,  State  and  Commerce  have  taken  few  actions  to  coordinate  their 
outreach  efforts  to  universities.  Though  State  engaged  in  six  outreach 
events  with  Commerce  between  November  2003  and  April  2004,  a  State 
official  explained  that  staffing  such  joint  events  with  Commerce  remains 
difficult  because  State  must  use  personnel  from  its  licensing  staff  to 
participate  in  these  events.  With  a  backlog  in  license  applications,  the 
processing  of  applications  is  a  priority,  and  the  agency  is  reluctant  to 
divert  those  personnel  to  outreach  efforts. 


Commerce  and  State  Have 
Not  Conducted  Analysis  to 
Identify  whether  Any  Risk 
Exists  to  Export- 
Controlled  Information  at 
Universities 


State  and  Commerce  officials  expressed  concerns  that  despite  the  export 
control  exclusions  for  university  research,  the  potential  may  exist  for 
foreign  nationals  to  access  controlled  defense  and  dual-use  technologies 
and  information  on  U.S.  campuses.  However,  neither  State  nor  Commerce 
has  analyzed  available  data  on  university  research  contracts  or  student 
fields  of  study  to  identify  any  potential  risk  to  export-controlled 
information  at  universities.  According  to  federal  internal  control 
standards,  agencies  need  to  conduct  risk  assessments  that  generally 
include  estimating  the  risk’s  significance  and  likelihood  of  occurrence, 
deciding  how  to  manage  the  risk  and  determining  what  actions  should  be 
taken.18 


In  the  absence  of  an  assessment  of  export  control  vulnerabilities  at 
universities,  State  officials  and  a  Commerce  Inspector  General  report 


16  Offices  of  Inspectors  General,  Interagency  Review  of  Foreign  National  Access  to 
Export-Controlled  Technology  in  the  United  States,  Report  No.  D-2004-062  (Washington, 
D.C.:  Apr.  16,  2004). 

17  See  GAO,  Export  Controls:  Improvements  to  Commerce’s  Dual-Use  System  Needed  to 
Ensure  Protection  of  U.S.  Interests  in  the  Post-9/11  Environment ,  GAO-06-638 
(Washington,  D.C.:  Jun.  26,  2006);  GAO,  Export  Controls:  Department  of  Commerce 
Controls  over  Transfers  of  Technology  to  Foreign  Nationals  Need  Improvement, 
GAO-02-972  (Washington,  D.C.:  Sept.  6,  2002);  and  GAO,  Export  Controls:  Processes  for 
Determining  Proper  Control  of  Defense-Related  Items  Need  Improvement,  GAO-02-996 
(Washington,  D.C.:  Sept.  20,  2002) 

18GAO,  Standards  for  Internal  Control  in  the  Federal  Government,  GAO/AIMD-OO-21.3.1 
(Washington,  D.C.:  November  1999). 
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stated  they  were  concerned  that  academic  officials  may  be  misinterpreting 
export  control  regulations  and  guidance.  According  to  State  officials, 
universities  are  unaware  of  the  nuances  of  export  control  regulations. 
Specifically,  they  said  universities  have  difficulty  distinguishing  and 
tracking  export  regulations  when  a  specific  project  develops  from  basic  to 
fundamental  or  applied  research.  For  example,  one  State  official 
questioned  whether  universities  devote  sufficient  resources  to  export 
compliance  and  apply  for  export  licenses  with  State  and  Commerce  to  the 
extent  their  research  activities  warrant.  This  official  believes  that 
academic  institutions  should  designate  individuals  responsible  for 
understanding  export  control  regulations  and  tracking  exports,  just  as 
companies  do.  However,  most  of  the  academic  institutions  we  visited  had 
designated  officials  who  were  responsible  for  export  control  issues. 

Despite  these  concerns,  Commerce  and  State  have  not  fully  assessed 
university  compliance  information  to  identify  the  potential  for  export 
control  vulnerabilities  in  university  research.  Commerce  and  State  are 
tasked  with  export  control  oversight,  including  administering  policy, 
processing  licenses,  and  reviewing  compliance  by  exporters.  According  to 
State  officials,  the  department  lacks  the  personnel  to  conduct  extensive 
compliance  audits.  Instead,  State  relies  on  voluntary  disclosure  of  possible 
export  control  violations — primarily  by  companies.  When  a  company 
notifies  State  of  a  possible  export  violation,  State  may  visit  the  company  to 
discuss  the  problem  and  offer  advice  on  weaknesses  in  the  company’s 
export  control  program.  According  to  State  officials,  State  does  not  target 
universities  for  compliance  and  has  not  visited  a  university  because 
universities  make  up  a  small  percentage  of  all  exporters.  Officials  stated 
that  Commerce’s  formal  compliance  review  program  is  focused  on 
deemed  export  license  holders,  the  majority  of  which  are  from  industry. 
Commerce  does  not  conduct  analyses  to  determine  whether  academic 
institutions  that  have  not  applied  for  licenses  are  in  compliance  with 
export  control  regulations.  Instead,  Commerce  uses  leads  generated  by 
intelligence  agencies,  internal  Commerce  sources,  or  the  public  via  a 
hotline  to  investigate  possible  cases  of  export  control  violations. 

Furthermore,  although  Commerce  gathers  information  about  certain 
universities’  research  activities  on  case-by-case  basis,  neither  Commerce 
nor  State  analyzes  available  federal  agency  data  on  university  research 
subjects  to  identify  trends  or  determine  the  potential  for  such  research  to 
be  subject  to  export  control  regulations.  Given  that  much  of  the  research 
conducted  at  U.S.  universities  is  federally  funded,  data  from  other 
government  agencies  on  the  subjects  of  research  conducted  at  academic 
institutions  could  supplement  data  from  Commerce  and  State.  For 
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example,  DOD  and  NASA  fund  research  at  universities,  some  of  which 
involves  technologies  that  could  become  export  controlled.  General 
information  on  federal  contracts  available  through  the  Federal 
Procurement  Data  System  could  also  provide  information  on  universities 
doing  high  volumes  of  research  for  other  federal  agencies.  However, 
neither  Commerce  nor  State  makes  use  of  these  data  sources  to  analyze 
trends  in  university  research.  Commerce,  instead,  relies  on  Internet 
searches  or  publicly  available  data  on  university  research  when  preparing 
to  meet  with  academic  officials. 

Other  data  could  help  Commerce  and  State  identify  potential  risks  of 
export  control  violations  at  academic  institutions.  Commerce  officials 
stated  that  some  foreign  nationals  on  U.S.  campuses  are  from  countries 
that  have  historically  tried  to  unlawfully  obtain  information  about 
American  technologies.  However,  while  Commerce  uses  visa  application 
data  to  generate  leads  for  specific  cases  of  deemed  export  violations,  it 
does  not  use  other  data  on  foreign  students’  and  scholars’  majors  or  fields 
of  study  to  identify  potential  areas  of  risk.  For  example,  the  Department  of 
Homeland  Security  administers  the  Student  and  Exchange  Visitor 
Information  System — a  database  that  tracks  student  nationality,  school 
enrollment,  and  changes  to  major  or  field  of  study — but  within  the  past  3 
years  neither  State  nor  Commerce  has  requested  these  data  from 
Homeland  Security  for  the  purposes  of  assessing  export  control  risks. 
While  a  Commerce  official  indicated  that  the  department  would  like  to 
work  with  Homeland  Security  in  the  future,  there  is  currently  no 
information  sharing  between  the  two  agencies  for  the  purpose  of 
identifying  trends  in  student  populations.  Similarly,  State  does  not  use  its 
Visas  Mantis  program — a  security  review  procedure  that  aims  to  identify 
visa  applicants  who  may  pose  a  threat  to  U.S.  national  security  by  illegally 
transferring  sensitive  technology — to  identify  trends  of  foreign  students 
and  scholars  and  their  fields  of  study,  although  it  occasionally  receives 
alerts  about  individuals  who  might  pose  an  export  control  risk. 

To  improve  controls  at  universities,  in  2005  Commerce  solicited 
information  on  the  impact  of  a  proposed  rule  change  that  would  have 
modified  the  definition  of  the  use  of  export-controlled  equipment  by 
foreign  nationals,  which  was  recommended  by  the  Commerce  Office  of 
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Inspector  General.19  Commerce  received  more  than  300  comments  in 
which  many  cited  the  potential  impact  on  university  research,  including 
numerous  comments  that  the  modified  definition  would  capture  too  many 
routine  operations  carried  out  by  students  and  employees  and  would  thus 
create  a  large  and  generally  unnecessary  compliance,  financial,  and 
administrative  burden  for  universities,  and  an  increased  licensing  burden 
on  Commerce.  Subsequently,  Commerce  withdrew  the  advanced  notice  of 
proposed  rule  change  in  May  2006. 

Recently,  U.S.  export  regulatory,  oversight,  and  law  enforcement  agencies 
have  taken  some  steps  to  engage  the  academic  community  on  export 
issues.  For  example,  in  September  2006,  Commerce  established  the 
Deemed  Export  Advisory  Committee  to  address  broad  export  control 
issues.  Specifically,  the  committee’s  charter  is  to  review  and  provide 
recommendations  to  Commerce  on  deemed  export  policy.  Thus,  this 
committee  will  be  responsible  for  ensuring  that  the  deemed  export 
licensing  policy  protects  national  security  while  ensuring  that  the  United 
States  continues  to  be  at  the  leading  edge  of  technological  innovations.  Its 
membership  includes  high-ranking  university  officials  and  chief  executive 
officers  of  companies.  According  to  Commerce  officials,  the  committee 
members  will  serve  for  approximately  one  year.  Commerce  officials  stated 
that  they  plan  to  address  the  issue  of  fundamental  research  in  the 
committee’s  work  and  to  include  participation  by  a  number  of  export 
control  agencies  in  committee  meetings.  Commerce  highlighted  one  such 
issue  in  a  May  2006  Federal  Register  notice  where  it  described  the 
difference  between  the  academic  community  views  that  export  controls 
would  only  apply  to  the  results  of  research,  and  the  Commerce  view  that 
export  controls  can  also  apply  to  the  conduct  of  research. 

In  September  2006,  the  Federal  Bureau  of  Investigation  established  a 
separate  forum  to  improve  its  lines  of  communication  with  the  academic 
community.  The  National  Security  Higher  Education  Advisory  Board — 
consisting  of  the  presidents  and  chancellors  of  several  prominent  U.S. 
universities — aims  to  foster  outreach  and  to  promote  understanding 
between  higher  education  and  the  Federal  Bureau  of  Investigation.  The 
board  will  provide  insight  on  the  higher  education  culture  of  openness, 
academic  freedom,  and  international  collaboration  and  dialogue  on  issues 
such  as  terrorism,  counterintelligence,  and  homeland  security.  In  addition, 


19  U.S.  Department  of  Commerce,  Office  of  Inspector  General,  Bureau  of  Industry  and 
Security,  Final  Inspection  Report  No.  IPE-16176,  Deemed  Export  Controls  May  Not  Stop 
the  Transfer  of  Sensitive  Technology  to  Foreign  Nationals  in  the  U.S.  (Washington,  D.C., 
Mar.  31,  2004). 
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the  Department  of  Homeland  Security's  Project  Shield  America  aims  to 
work  with  exporters  of  U.S.  technologies  that  could  be  illegally  exported, 
in  particular,  technologies  used  in  weapons  of  mass  destruction. 
According  to  a  DHS  official,  the  project's  first  outreach  effort  specifically 
targeting  the  U.S.  academic  community  was  scheduled  to  be  held  at  the 
beginning  of  December  2006. 


Conclusions 


Balancing  the  desire  to  attract  gifted  foreign  research  scientists  to  U.S. 
universities  and  the  need  to  ensure  that  export-controlled  research  at 
universities  is  not  compromised  is  a  considerable  challenge.  Since 
government  agencies  place  the  responsibility  for  complying  with  export 
control  regulations  on  universities  and  other  exporting  entities,  it  is 
essential  that  Commerce  and  State,  the  two  agencies  primarily  charged 
with  administering  export  regulations,  understand  whether  universities 
correctly  interpret  and  apply  relevant  export  control  policies  and 
regulations  when  deciding  whether  their  research  is  subject  to  export 
controls.  Despite  some  concerns  that  universities  may  not  understand 
their  responsibilities  when  conducting  research,  Commerce  and  State  have 
not  leveraged  available  government  information  and  assessed  potential 
risks  of  illegal  transfers  of  export-controlled  information  at  universities. 
Furthermore,  although  Commerce  and  State  have  separate  export  control 
jurisdictions,  the  lack  of  coordination  between  these  agencies  on 
outreach,  analysis,  and  oversight  could  hamper  their  ability  to  determine 
whether  export-controlled  information  may  be  at  risk  of  transfer  to  foreign 
nationals  in  the  course  of  university  research.  Without  such  knowledge, 
the  government  agencies  cannot  determine  whether  their  guidance  and 
training  for  universities  is  appropriate  and  sufficient  and  whether  their 
resources  are  strategically  targeted  to  optimize  their  ability  to  regulate  and 
monitor  universities’  research.  Until  Commerce  and  State  take  such  steps, 
sensitive  information  may  remain  vulnerable  to  improper  transfer, 
potentially  putting  at  risk  U.S.  national  security  interests. 


Recommendations 
Executive  Actions 


for 


To  improve  the  Department  of  Commerce’s  oversight  of  export-controlled 
information  under  its  jurisdiction  at  universities,  we  recommend  that  the 
Secretary  of  Commerce  direct  the  Administrator  of  the  Bureau  of  Industry 
and  Security  to 


•  strategically  assess  potential  vulnerabilities  in  the  conduct  and 
publication  of  academic  research  by  becoming  more  knowledgeable 
about  research  being  conducted  on  university  campuses  and,  in 
consultation  with  other  agencies,  make  use  of  available  information  on 
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technology  development  and  foreign  student  populations  at 
universities  to  assess  the  extent  to  which  research  at  universities  may 
be  subject  to  export  controls  and 

•  on  the  basis  of  this  assessment  of  university  research  and  foreign 
student  populations,  improve  interagency  coordination,  conduct 
additional  outreach,  and  improve  guidance  to  ensure  that  universities 
understand  when  to  apply  export  controls. 

To  improve  the  Department  of  State’s  oversight  of  export-controlled 
information  under  its  jurisdiction  at  universities,  we  recommend  that  the 
Secretary  of  State  direct  the  Director  of  the  Directorate  of  Defense  Trade 
Controls  to 

•  strategically  assess  potential  vulnerabilities  in  the  conduct  and 
publication  of  academic  research  by  becoming  more  knowledgeable 
about  research  being  conducted  on  university  campuses  and,  in 
consultation  with  other  agencies,  make  use  of  available  information  on 
technology  development  and  foreign  student  populations  at 
universities  to  assess  the  extent  to  which  research  at  universities  may 
be  subject  to  export  controls  and 

•  on  the  basis  of  this  assessment  of  university  research  and  foreign 
student  populations,  improve  interagency  coordination,  conduct 
additional  outreach,  and  improve  guidance  to  ensure  that  universities 
understand  when  to  apply  export  controls. 


Agency  Comments 
and  our  Evaluation 


We  provided  a  draft  of  this  report  to  the  Departments  of  Commerce, 
Defense,  Homeland  Security,  and  State  for  their  review  and  comment. 
Commerce  and  State  provided  written  comments,  which  are  reprinted  in 
appendixes  II  and  III,  respectively.20  Defense  did  not  have  any  comments 
on  our  draft  report.  Homeland  Security  provided  technical  comments, 
which  are  incorporated  as  appropriate  throughout  the  report. 

The  Department  of  Commerce  generally  agreed  with  the  report’s 
recommendations,  and  stated  that  the  Deemed  Export  Advisory 


20  Commerce’s  response  letter  also  included  comments  on  our  draft  report  on  export 
controlled  information,  Export  Controls:  Agencies  Should  Assess  Vulnerabilities  and 
Improve  Guidance  for  Protecting  Export-Controlled  Information  at  Companies, 
GAO-07-69  (Washington,  D.C.:  Dec.  5,  2006). 
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Committee  will  aid  in  this  respect.  However,  Commerce  stated  that 
Student  and  Exchange  Visitor  Information  System  (SEVIS)  data  are  too 
general  for  use  in  identifying  whether  foreign  students  and  scholars  are 
subject  to  deemed  export  license  requirements  and  that  the  collection  of 
more  specific  visa  application  information  is  needed  to  assess 
vulnerabilities.  While  we  agree  that  additional  information  from  the  visa 
application  process  could  be  useful,  we  found  that  SEVIS  data  include 
information  that  State  and  Commerce  could  use  to  perform  general  trend 
analysis  to  determine  where  best  to  focus  outreach  and  compliance  efforts 
at  the  university  level.  For  example,  an  analysis  of  the  majors  that  foreign 
students  and  scholars  are  pursuing  at  universities  with  large  federal 
research  contracts  could  provide  Commerce  and  State  with  a  proactive 
plan  for  targeting  their  outreach  and  training  efforts  for  the  academic 
community.  Furthermore,  while  Commerce  states  that  about  one-third  of 
its  outreach  events  focus  on  the  academic  community,  as  our  report 
states,  we  found  that  several  of  the  events  that  Commerce  classified  as 
academic  outreach  were  actually  targeted  at  government  research  entities. 
Finally,  Commerce  correctly  notes  that  our  report  focuses  on  fundamental 
research  or  other  research  that  may  be  subject  to  export  controls  while 
excluding  other  research  that  falls  outside  of  the  export  control  universe. 
We  identified  the  application  of  the  fundamental  research  exclusion  as  a 
significant  issue  between  the  academic  community  and  Commerce,  and  as 
Commerce’s  letter  notes,  some  universities  could  benefit  from  a  better 
understanding  of  deemed  export  control  requirements.  Our  report 
indicates  that  an  assessment  of  the  vulnerabilities  will  best  allow 
Commerce  to  focus  its  outreach  and  training  efforts  toward  addressing 
this  issue  with  the  academic  community. 

State  agreed  with  our  recommendation  to  improve  interagency 
coordination  on  training  and  guidance  for  universities  and  disagreed  with 
our  report’s  finding  that  it  does  not  assess  the  potential  vulnerabilities 
associated  with  export-controlled  information  at  academic  institutions. 
State  responded  that  it  is  currently  working  with  the  Department  of 
Commerce  and  the  Department  of  the  Treasury  to  conduct  an  export 
control  conference  during  2007  specifically  aimed  at  universities.  As  we 
recommended  in  our  report,  such  outreach  that  is  specifically  targeted  to 
the  academic  community,  particularly  in  coordination  with  other  agencies, 
could  improve  universities’  understanding  of  regulations  concerning 
export  controlled  information.  However,  while  such  outreach  may  help 
universities  seeking  guidance  on  deemed  export  regulations,  State  would 
benefit  from  strategically  assessing  vulnerabilities  at  universities  using 
readily  available  data,  such  as  SEVIS,  to  help  the  department  identify  and 
address  areas  of  potential  risk.  While  State  disagreed  with  our 
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recommendation,  in  its  response  it  noted  that  it  is  considering  conducting 
such  an  assessment.  A  trend  analysis  conducted  on  SEVIS  and  federal 
procurement  data  would  be  a  valuable  investment  in  providing  a  proactive 
plan  for  targeting  outreach  and  training  for  universities.  State  also 
provided  technical  comments,  which  we  incorporated  throughout  the 
report,  as  appropriate. 


We  are  sending  copies  of  this  report  to  appropriate  congressional 
committees  and  to  the  Secretary  of  Commerce,  the  Secretary  of  Defense, 
the  Secretary  of  Homeland  Security,  and  the  Secretary  of  State.  Copies  will 
be  made  available  to  others  upon  request.  In  addition,  this  report  will  be 
available  at  no  charge  on  the  GAO  Web  site  at  http://www.gao.gov. 

If  you  or  your  staff  have  any  questions  about  this  report,  please  contact  me 
on  (202)  512-7333.  Key  contributors  to  this  report  are  acknowledged  in 
appendix  IV. 

Sincerely, 


John  Hutton,  Acting  Director 
Acquisition  and  Sourcing  Management 
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To  describe  the  nature  of  the  research  conducted  at  universities  and 
identify  the  steps  they  have  taken  to  comply  with  government  export 
control  regulations,  we  interviewed  and  obtained  documentation  from 
officials  at  13  universities  in  positions  such  as  vice  chancellor  for  research, 
director  of  compliance,  and  general  counsel.  We  conducted  our  review  at 
the  following  13  universities:  Boston  University,  Boston,  Massachusetts; 
California  Institute  of  Technology,  Pasadena,  California;  Carnegie  Mellon 
University,  Pittsburgh,  Pennsylvania;  Colorado  State  University,  Fort 
Collins,  Colorado;  George  Washington  University,  Washington,  D.C.;  Johns 
Hopkins  University,  Baltimore,  Maryland;  Massachusetts  Institute  of 
Technology,  Cambridge  and  Lexington,  Massachusetts;  Stanford 
University,  Stanford,  California;  University  of  California  at  Berkeley; 
University  of  California  at  Los  Angeles;  University  of  Colorado  at  Boulder; 
University  of  Maryland  at  College  Park;  and  the  University  of  Southern 
California,  Los  Angeles,  California.  To  get  a  general  overview  of  the  nature 
of  research  at  universities,  we  also  spoke  by  telephone  with  officials  from 
the  Association  of  American  Universities,  Association  of  University 
Technology  Managers,  National  Council  of  University  Research 
Administrators,  and  the  Southwest  Research  Institute.  To  systematically 
select  the  universities  that  we  visited,  we  cross-tabulated  data  on 
universities  with  large  numbers  of  international  students  or  scholars,  those 
that  are  associated  with  federally  funded  research  centers,  those  that  had 
applied  for  International  Traffic  in  Arms  Regulations  or  Export 
Administration  Regulations  export  licenses,  and  those  that  had  high-dollar 
contracts  with  either  the  Department  of  Defense  or  other  government 
entities.  While  some  of  the  selected  academic  institutions  fall  within  the 
top  tiers  across  the  selection  criteria,  their  views  stated  in  this  report  do 
not  represent  those  of  the  entirety  of  the  U.S.  academic  community. 

To  assess  Commerce’s  and  State’s  efforts  to  determine  the  risk  of  export 
violations  in  university  research,  we  interviewed  officials  from  the  Bureau 
of  Industry  and  Security  of  the  Department  of  Commerce  and  its  related 
export  offices:  National  Security  and  Technology  Transfer  Controls, 
Exporter  Services,  Export  Administration,  Export  Enforcement.  We  also 
interviewed  officials  in  the  Department  of  Commerce’s  Offices  of  General 
Counsel  and  Inspector  General.  At  the  Department  of  State,  we 
interviewed  officials  and  reviewed  data  from  the  Bureau  of  Political- 
Military  Affairs’  Directorate  of  Defense  Trade  Controls,  the  Bureaus  of 
Consular  Affairs  and  International  Security  and  Nonproliferation,  and  the 
Office  of  the  Inspector  General.  We  obtained  and  analyzed  regulations, 
guidance,  and  training  documents  from  these  departments.  We  also 
collected  data  and  other  documentation  and  met  with  officials  from  the 
Office  of  Defense  Procurement  and  Acquisition  Policy  of  the  Department 
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of  Defense  and  the  Department  of  Homeland  Security’s  Immigration  Policy 
Directorate  and  U.S.  Immigration  and  Customs  Enforcement. 

We  conducted  our  work  from  March  2006  through  November  2006  in 
accordance  with  generally  accepted  government  auditing  standards. 
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of  Commerce 


November  22,  2006 


THE  SECRETARY  OF  COMMERCE 

Washington,  D.C.  20230 


Mr.  John  Hutton 

Acting  Director,  Acquisition  and  Sourcing  Management 
Government  Accountability  Office 
441  G  Street,  NW.  Room  4718 
Washington,  DC  20548 

Dear  Mr.  Hutton: 

Thank  you  for  the  opportunity  to  provide  comments  on  two  related  Government 
Accountability  Office  (GAO)  Draft  Reports,  Export  Controls:  Agencies  Should  Assess 
Vulnerabilities  and  Improve  Guidance  for  Protecting  Export-Controlled  Information  at  Companies , 
GAO-07-69,  and  Export  Controls:  Agencies  Should  Assess  Vulnerabilities  and  Improve  Guidance  on 
Protecting  Export-Controlled  Information  at  Universities,  GAO-07-70. 

Along  with  a  March  2004  report  by  the  Commerce  Department’s  Office  of  Inspector  General 
(Inspection  Report  No.  IPE-16176),  these  reports  help  draw  attention  to  the  importance  of  protecting 
sensitive  export-controlled  information  without  impeding  the  competitive  position  of  U.S.  industry 
and  academia.  Indeed,  the  issue  of  deemed  exports  is  one  that  has  received  and  continues  to  receive 
considerable  attention  from  the  Commerce  Department’s  Bureau  of  Industry  and  Security  (BIS). 

Noting  that  deemed  exports  under  the  Export  Administration  Regulations  (EAR)  are  separate 
from  technology  transfer  restrictions  under  the  International  Trade  in  Arms  Regulations  (ITAR),  we 
generally  agree  with  the  reports’  recommendations  to  assess  potential  vulnerabilities  within  industry 
and  academia  and  then  conduct  more  targeted  deemed  export  outreach  and  compliance  activities.  As 
the  reports  note,  BIS  has  already  taken  significant  action  in  this  regard.  In  September,  the  Commerce 
Department  established  the  Deemed  Export  Advisory  Committee  (DEAC),  co-chaired  by  Robert 
Gates,  President  of  Texas  A&M  University,  and  Norman  Augustine,  retired  Chairman  and  CEO  of 
Lockheed  Martin  Corporation,  to  review  the  entire  issue  of  deemed  exports.  (Dr.  Gates  was 
subsequently  nominated  by  President  Bush  as  Secretary  of  Defense,  and  we  are  in  the  process  of 
identifying  a  replacement  as  co-chair.)  The  DEAC  has  high-level  members  from  industry,  academia, 
and  the  security  field  who  will  review  and  make  recommendations  to  me  on  how  best  to  ensure  that 
transfers  of  sensitive  technologies  to  foreign  nationals  protect  vital  national  security  interests  while 
ensuring  that  U.S.  companies  and  universities  continue  to  be  the  world’s  leaders  in  research  and 
development. 

In  addition,  BIS  has  expanded  its  already  robust  deemed  export  outreach  program  in  all 
high-technology  sectors,  including  universities,  industry,  and  government  laboratories.  Significant 
outreach  efforts  have  been  undertaken  with  industry  sectors  and  compliance  officials  on  the 
requirements  for  deemed  exports,  including  the  requirement  that  license  applications  have  in  place  a 
Technology  Control  Plan  (TCP)  to  protect  export-controlled  information  from  unauthorized  release. 
BIS  publishes  best  practices  guidance  on  TCPs  on  its  website  and  discusses  TCP  requirements  in 
enforcement  outreach  visits.  Significantly,  in  September  2006,  BIS  officials  addressed  the  annual 
convention  of  the  American  Society  for  Industrial  Security  (ASIS),  a  trade  association  of  information 
and  physical  security  management  professionals,  on  the  protection  of  export-controlled  information 
and  essential  elements  of  TCPs  in  protecting  such  information  from  unauthorized  access  and  release. 
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In  addition  to  its  Fiscal  Year  2005  pilot  program  for  deemed  export  compliance  verification, 
BIS  has  also  initiated  a  formal  Deemed  Export  Compliance  Review  Program.  Under  this  program, 
BIS  conducts  formal  compliance  reviews  of  deemed  export  license  holders’  compliance  with  license 
conditions,  including  the  efficacy  of  their  required  TCPs.  Deemed  export  licenses  are  targeted  for 
review  based  on  the  sensitivities  of  the  technology  involved  (e.g.,  such  as  that  connected  with 
weapons  of  mass  destruction  development)  and  countries  involved.  BIS  completed  14  reviews  under 
this  program  in  Fiscal  Year  2006,  and  will  continue  reviews  under  the  program  in  Fiscal  Year  2007. 

Finally,  BIS  has  worked  closely  with  other  agencies  to  gather  data  on  potential  risks  of 
unauthorized  technology  transfers  at  universities.  We  have  found  that  existing  data,  such  as  that 
found  in  the  Department  of  Homeland  Security’s  Student  and  Exchange  Visitor  Information  System, 
is  often  too  general  to  be  useful  in  identifying  whether  foreign  nationals  will  be  subject  to  deemed 
export  license  requirements.  Therefore,  we  have  taken  specific  steps  to  improve  this  data,  such  as 
suggesting  revisions  to  the  relevant  visa  application  form  to  collect  information  needed  to  assess 
technology  transfer  vulnerabilities  from  foreign  nationals  in  the  United  States. 

Based  on  the  Department’s  work  to  date  and  the  findings  of  your  reports  and  other  studies,  it 
is  clear  that  some  universities  and  research  institutions  need  to  acquire  a  better  understanding  of 
deemed  export  control  requirements.  Because  we  recognize  the  important  need  to  improve 
understanding  of  deemed  export  license  requirements  at  universities,  about  one-third  of  BIS’s  120 
annual  deemed  export  outreach  activities  now  focus  on  the  academic  community.  At  the  same  time, 
however,  it  is  important  to  note  that  deemed  export  licensing  consideration  is  required  only  if  a 
foreign  national  has  access  to  export-controlled  technology.  The  EAR  identifies  a  larger  universe  of 
information  that  is  not  subject  to  the  Department’s  regulatory  oversight  and,  therefore,  is  not  export- 
controlled.  The  full  context  of  this  universe  bears  mentioning  since  it  is  not  fully  addressed  in  the 
report,  which  focuses  primarily  on  the  concept  of  fundamental  research.  As  noted  in  Section 
734.3(3)  of  the  EAR,  certain  publicly  available  technology  is  not  subject  to  the  requirements  of  the 
EAR.  This  includes  information  that  is  already  published  or  will  be  published.  Section  734.8  of  the 
EAR  clarifies  that  the  information  resulting  from  fundamental  research  which  is  intended  for 
publication  is  considered  publicly  available  and  thus  not  subject  to  the  EAR. 

Informed  by  the  reports’  findings  and  recommendations  and  actions  taken  to  date,  BIS  will 
continue  to  assess  vulnerabilities  and  work  to  more  precisely  target  outreach  and  compliance  efforts. 
BIS’s  efforts  will  also  be  significantly  informed  by  the  recommendations  of  the  DEAC,  which  we 
currently  expect  to  receive  in  the  fall  of  2007. 


Sincerely, 
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Ms.  Jacquelyn  Williams-Bridgers 
Managing  Director 
International  Affairs  and  Trade 
Government  Accountability  Office 
441  G  Street,  N.W. 

Washington,  D.C.  20548-0001 


United  States  Department  of  State 

Assistant  Secretary  for  Resource  Management 
and  Chief  Financial  Officer 

Washington,  D.C.  20520 

NOV  3  0  2006 


Dear  Ms.  Williams-Bridgers: 

We  appreciate  the  opportunity  to  review  your  draft  report, 
“EXPORT  CONTROLS:  Agencies  Should  Assess  Vulnerabilities  and 
Improve  Guidance  for  Protecting  Export-Controlled  Information  at 
Universities,”  GAO  Job  Code  120508. 

The  enclosed  Department  of  State  comments  are  provided  for 
incorporation  with  this  letter  as  an  appendix  to  the  final  report. 

If  you  have  any  questions  concerning  this  response,  please  contact 
Patricia  Slygh,  Acting  Director  of  Management,  Bureau  of  Political  and 
Military  Affairs  at  (202)  663-2844. 

Sincerely, 


cc:  GAO  -  John  Neumann 

PM  -  Gregory  Suchan 
State/OIG  -  Mark  Duda 
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Department  of  State  Comments  on  GAO  Draft  Report 

EXPORT  CONTROLS:  Agencies  Should  Assess  Vulnerabilities 
and  Improve  Guidance  for  Protecting  Export-Controlled 
Information  at  Universities 
(GAO-07-70,  GAO  Code  120508) 

Thank  you  for  allowing  the  Department  of  State  the  opportunity  to  comment 
on  draft  report  “ Export  Control:  Agencies  Should  Assess  Vulnerabilities  and 
Improve  Guidance  on  Protecting  Export-Controlled  Information  at  Universities.  ” 

The  report  highlights  the  potential  risks  of  foreign  students  at  universities 
being  exposed  to  export  controlled  technology  with  or  without  proper  authorization 
and  makes  recommendations  for  both  the  Department  of  State  and  the  Department 
of  Commerce  regarding  risk  assessment  and  increased  training  and  outreach  for 
universities.  The  Department  agrees  with  the  GAO  with  respect  to  the  need  for 
increased  training  and  outreach  and  is  currently  working  with  the  Department  of 
Commerce  and  the  Department  of  Treasury  to  conduct  an  export  control 
conference  during  2007  specifically  aimed  at  universities.  We  disagree  with  the 
GAO’s  assertion  that  we  are  not  presently  assessing  the  risk  of  unauthorized  data 
exports.  While  State’s  DDTC  may  not  have  concretely  quantified  the  potential 
risk,  there  is  a  recognition  that  a  risk  exists.  We  estimate  that  it  would  take  from 
one-half  to  one  full  man  year  to  conduct  an  assessment  and  are  presently 
determining  if  we  can  conduct  the  study,  along  with  the  planned  outreach  to 
universities  in  FY  2007,  within  the  limits  of  existing  resources. 
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GAO’s  Mission 

The  Government  Accountability  Office,  the  audit,  evaluation  and 
investigative  arm  of  Congress,  exists  to  support  Congress  in  meeting  its 
constitutional  responsibilities  and  to  help  improve  the  performance  and 
accountability  of  the  federal  government  for  the  American  people.  GAO 
examines  the  use  of  public  funds;  evaluates  federal  programs  and  policies; 
and  provides  analyses,  recommendations,  and  other  assistance  to  help 
Congress  make  informed  oversight,  policy,  and  funding  decisions.  GAO’s 
commitment  to  good  government  is  reflected  in  its  core  values  of 
accountability,  integrity,  and  reliability. 

Obtaining  Copies  of 
GAO  Reports  and 
Testimony 

The  fastest  and  easiest  way  to  obtain  copies  of  GAO  documents  at  no  cost 
is  through  GAO’s  Web  site  (www.gao.gov).  Each  weekday,  GAO  posts 
newly  released  reports,  testimony,  and  correspondence  on  its  Web  site.  To 
have  GAO  e-mail  you  a  list  of  newly  posted  products  every  afternoon,  go 
to  www.gao.gov  and  select  “Subscribe  to  Updates.” 

Order  by  Mail  or  Phone 

The  first  copy  of  each  printed  report  is  free.  Additional  copies  are  $2  each. 

A  check  or  money  order  should  be  made  out  to  the  Superintendent  of 
Documents.  GAO  also  accepts  VISA  and  Mastercard.  Orders  for  100  or 
more  copies  mailed  to  a  single  address  are  discounted  25  percent.  Orders 
should  be  sent  to: 

U.S.  Government  Accountability  Office 

441  G  Street  NW,  Room  LM 

Washington,  D.C.  20548 

To  order  by  Phone:  Voice:  (202)  512-6000 

TDD:  (202)  512-2537 

Fax:  (202)  512-6061 

To  Report  Fraud, 
Waste,  and  Abuse  in 
Federal  Programs 

Contact: 

Web  site:  www.gao.gov/fraudnet/fraudnet.htm 

E-mail:  fraudnet@gao.gov 

Automated  answering  system:  (800)  424-5454  or  (202)  512-7470 

Congressional 

Relations 

Gloria  Jarmon,  Managing  Director,  JarmonG@gao.gov  (202)  512-4400 

U.S.  Government  Accountability  Office,  441  G  Street  NW,  Room  7125 
Washington,  D.C.  20548 

Public  Affairs 


Paul  Anderson,  Managing  Director,  AndersonPl@gao.gov  (202)  512-4800 
U.S.  Government  Accountability  Office,  441  G  Street  NW,  Room  7149 
Washington,  D.C.  20548 
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